“Only the paranoid survive.” – Qubes OS signature mismatch
1–10 of 24 posts
Re: “Only the paranoid survive.” – Qubes OS signature mismatch
#2There are a bunch of reasons this could've happened -- corrupted downloads are not unheard of on poor connections. Maybe the file was truncated.
Or maybe it was the NSA. Without any further analysis, this isn't particularly noteworthy.
Re: “Only the paranoid survive.” – Qubes OS signature mismatch
#3There's nothing yet to suggest that it's not just a corrupted download.
Re: “Only the paranoid survive.” – Qubes OS signature mismatch
#4Seeking publicity instead of trying to redownload and verify.
News today, sigh :(
Re: “Only the paranoid survive.” – Qubes OS signature mismatch
#5Best way to elevate your crypto project, get targeted. Doesn't matter if it actually happened.
Re: “Only the paranoid survive.” – Qubes OS signature mismatch
#6There are a bunch of reasons this could've happened -- corrupted downloads are not unheard of on poor connections. Maybe the file was truncated. Or maybe it was the NSA. Without any further analysis, this isn't particularly noteworthy.
The first step is to detect the wrong signature. The next step is to compare the files to see whether truncation, bitswap etc. happened or whether the manipulation went deeper. Or for the more paranoid people: See what dangerous attack code can be introduced into the software by such an innocent-looking manipulation and whether the modification that happened did introduce such an exploit or not.
Re: “Only the paranoid survive.” – Qubes OS signature mismatch
#7Can't speak to targeted interference, but I can fetch the ISO and signature from the mirror he used, and verify it successfully.
output: https://gist.github.com/daveio/edac4aaee516cd6a408d5c8e763ce...
Re: “Only the paranoid survive.” – Qubes OS signature mismatch
#8There are a bunch of reasons this could've happened -- corrupted downloads are not unheard of on poor connections. Maybe the file was truncated. Or maybe it was the NSA. Without any further analysis, this isn't particularly noteworthy.
You can those questions in the reply thread (Is it the right file size? Can you mount it?)
This will only be interesting if it isn't just a corrupted image. If it isn't a corrupt image, I hope there a follow-up with a diff-tree between the two.
Re: “Only the paranoid survive.” – Qubes OS signature mismatch
#9[deleted]
Re: “Only the paranoid survive.” – Qubes OS signature mismatch
#10Redownload. Check again. I'm on satellite internet with the horrible latencies and frequent timeouts associated with that tech, I recently had the netinstall image for Debian fail integrity checking three times in a row, from the http mirrors. Guy from the link said it himself, download via torrent and all is well.
Generally, being on such terrible interwebs I get angry whenever I hear people claim torrents are only for piracy. We all know they're wrong, but my legal torrent use has really never been more intense. Rsync's ability for aggressive retrying is also blessed :)